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REMARKS 

Claims 1-16 remain pending in this application. Claims 1 and 8 have been amended 
hereby to correct minor matters of form. No substantive changes have been made to the claims. 
For the reasons stated below, Applicants respectfully submit that all claims pending in this 
application are in condition for allowance. 

In the Office Action, claims 1-16 were rejected under 35 U.S.C. §103(a) as being 
unpatentable over Allison et al. (WO 200271234 A) ("Allison") in view of Gould et al (U.S. 
2004/0199592 Al) ("Gould"). This ground of rejection is respectfully traversed. 

The present invention, as recited in the claims, is directed to methods for detecting 
undesirable events that may occur in a network. More specifically, the claimed embodiments of 
the present invention are configured to detect unwanted "spam" messages or undesirable routing 
loop conditions. This is accomplished by keeping track of not only the number of times that a 
message is received from a given source (and perhaps destined for a given destination) using a 
counter, but also of what time each given message is received by using timestamps. 

In accordance with the pending claims, an array of timestamps is provided for each 
source (and/or destination) address, and this array is processed to remove entries that fall outside 
of a sliding timing window. The counter is decremented for each timestamp array entry that is 
removed. In this way, it is possible to better determine whether a threshold number of messages 
from the given source (or destination) has been received over a predetermined period of time. 

As explained in, e.g., paragraph [0019] of the specification, "[w]ith the counter and 
timestamp information, it is possible in accordance with the present invention to implement an 
efficient "jumping window" of fixed size by using a "garbage collection method" that removes 
all entries older than a fixed window size in regular intervals." (Emphasis added.) Without the 
expressly claimed "timestamp array" aspect of the invention (along with the counter aspect), any 
such "garbage collection method" cannot be efficiently performed. 

Allison discloses a method for preventing short message service (SMS) message 
flooding. It is acknowledged in the Office Action, however, that Allison does not disclose the 
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"array of timestamps" feature of the claimed invention. For this feature, the Office Action cites 
to Gould. 

Gould discloses a system and method for managing e-mail message traffic. Paragraphs 

[0035]-[0038] describe a methodology in which metrics of a first email message from a given IP 

address are stored in a datastore. Those metrics include a timestamp for that message and a 

counter associated with the IP address. When a subsequent email message is received from the 

IP address, the counter is incremented and it is determined if the counter has exceeded a 

threshold, and if so, an email message rate is calculated 

based on the time-stamp data of the e-mail message count 1 (the 
first e-mail message). The time represented by the time stamp of 
the first message is subtracted from the time represented by the 
timestamp of the newly arrived message (e-mail message "n") to 
compute the time period over which the "nth" message arrived. 
The e-mail message rate is determined by dividing "n" by the 
computed time period. 

(Paragraph [0037] of Gould.) 

Based on the foregoing, it is quite clear that Gould does not describe a methodology in 
which an array of timestamps "including a timestamp entry for respective source counter 
increments" is stored for further processing. Indeed, Gould specifically describes a methodology 
in which timestamps of individual messages are ignored until a coimter threshold is exceeded. 
Only then is the timestamp of the nth message determined and processed in connection with the 
timestamp of the first message. Notably, the timestamps of all intervening e-mail messages are 
irrelevant in Gould. In contrast, in the claimed invention, the timestamps associated with each 
message counted by the counter is stored for processing ("the array of timestamps including a 
timestamp entry for respective source counter increments "). See also paragraph [0021] of the 
present application. 

With that rich data, it is then possible, in accordance with the claimed invention, to 

remove entries in the array of timestamps that are older than a fixed window, and decrement the 

counter for each entry so removed. Such steps are impossible to implement in a system or 
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method described by Gould because Gould simply does not store the respective timestamps of 
messages associated with source counter increments. In short, Gould does not disclose or teach 
any type of timestamp array like that required by the claims of the present application. 

Since Allison is acknowledged not to disclose the timestamp array feature of the claimed 
invention and Gould does not disclose this same feature for the reasons outlined above, the 
§ 103(a) rejection of the claims based on Allison and Gould should be withdrawn. 

In view of the forgoing, all of the claims in this case are believed to be in condition for 
allowance. Should the Examiner have any questions or determine that any further action is 
desirable to place this application in even better condition for issue, the Examiner is encouraged 
to telephone applicants' undersigned representative at the number listed below. 



Dated: February 14, 2008 Respectfully submitted by: 

Edell, Shapiro & Finnan, LLC /Lawrence D. Eisen/ 

Customer No. 27896 Lawrence D. Eisen 

1 90 1 Research Boulevard, Suite 400 Reg. No. 4 1 009 
Rockville, MD 20850 
(301)424-3640 



